Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hacker Warns Starbucks of Security Flaw, Gets Accused of Fraud

Posted by Soulskill on from the biting-the-hand-that-doesn't-steal-from-you dept.

Andy Smith writes: Here's another company that just doesn't get security research. White hat hacker Egor Homakov found a security flaw in Starbucks gift cards which allowed people to steal money from the company. He reported the flaw to Starbucks, but rather than thank him, the company accused him of fraud and said he had been acting maliciously.

23 of 107 comments (clear)

  1. No good deed goes unpunished by localroger · · Score: 5, Funny

    He would have been better off helping himself to free coffee until the wankers fixed their system.

    --
    Brackets contain world's first nanosig, highly magnified:[.]
    1. Re:No good deed goes unpunished by infolation · · Score: 5, Insightful

      In the old days, he'd have posted it in 2600 and we'd ALL've got some free coffee.

      No free lunches anymore :[

    2. Re:No good deed goes unpunished by AmiMoJo · · Score: 5, Insightful

      The sad thing is that publishing the vulnerability anonymously, in 2600 or on one of the disclosure mailing lists, is now the responsible thing to do. Not great for the company involved, but it protects the researcher and it protects the user in some cases.

      At this point I'd only even consider warning the company before anonymously publishing the vulnerability if they had a bug bounty programme. Not because I want money, but because it's the only way to be sure they will actually be thankful and not call the cops right away.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:No good deed goes unpunished by Anonymous Coward · · Score: 2, Interesting

      In the new days, he posts to Sacurity and 5000 bored coders implement his hack for the hell of it.

      They start with $100 gift cards and double their money.

      Starbucks is out half a million dollars on the first day. The second day it's 5x that.

      Since it's a Saturday, this goes on until Monday, 11am Pacific time. Emergency meetings are held but the hole can't be plugged overnight.

      Total loss to the company is about $5 million by Wednesday afternoon.

    4. Re:No good deed goes unpunished by Anonymous Coward · · Score: 4, Informative

      In the old days, he'd have posted it in 2600 and we'd ALL've got some free coffee.

      No free lunches anymore :[

      weird, I had a dream last night I was buying a 2600 from a bookstore. It's been a long time since I've bought one though. Long time since I bought any magazine actually.

      I work in a bookstore and we still sell 2600 regularly.

  2. You stole too little by rebelwarlock · · Score: 5, Insightful

    Everyone knows that you get a negative reaction for stealing a small amount. Steal a couple million and you'll be respected.

    1. Re:You stole too little by fahrbot-bot · · Score: 2, Insightful

      Everyone knows that you get a negative reaction for stealing a small amount. Steal a couple million and you'll be respected.

      Not just stealing. As Eddie Izzard pointed out in his standup performance Dress to Kill:

      You know, we think if somebody kills someone, that's murder, you go to prison. You kill 10 people, you go to Texas, they hit you with a brick, that's what they do. 20 people, you go to a hospital, they look through a small window at you forever. And over that, we can't deal with it, you know?

      Someone's killed 100,000 people. We're almost going, "Well done! You killed 100,000 people? You must get up very early in the morning. I can't even get down the gym! Your diary must look odd: “Get up in the morning, death, death, death, death, death, death, death – lunch- death, death, death -afternoon tea - death, death, death - quick shower"

      --
      It must have been something you assimilated. . . .
  3. Starschmucks by Morrighu · · Score: 2

    Foamy the Squirrel nailed it.

  4. My email to press@starbucks.com by Anonymous Coward · · Score: 5, Insightful

    "Egor Homakov did you a favor, I think you owe him a thank you, and an apology for your response to his discovery of a security flaw in your system.

    This will be your only hope if another security flaw is found, and the discoverer of the flaw now ponders between letting Starbucks know (less likely after your response to Egor Homakov), not letting anyone know (which leaves the security flaw available for anyone to use), or letting the wrong people know about this flaw!

    I feel like I am explaining something to a child. You are a corporation, act like one!"

    1. Re:My email to press@starbucks.com by Andy+Smith · · Score: 4, Insightful

      For most of my life I've worked freelance so I haven't had much experience of the corporate world. But I recently worked for a small newspaper company (approx 400 employees) for a year and it was an eye-opening experience. It amazes me how anything ever gets done in these blind, ignorant, slow-moving organisations.

      I'll give you one example. The company's web filter had an issue with our own web sites, which prevented us from reading them. When I asked IT about it they knew what the problem was, but they couldn't authorise the fix and they suggested I raise the issue with my manager. But my manager was unapproachable -- asking for something to be done was the best way to make sure it didn't get done. It took over a YEAR for a small newspaper company to fix an IT issue that prevented staff from reading their own newspapers' web sites.

      I dread to think what life must be like in big corporations. I don't want to ever experience it.

    2. Re:My email to press@starbucks.com by sumdumass · · Score: 4, Informative

      It's probably hit with a spam filter before it even reaches him.

      In the email servers I administrate, we white list known addresses and segregate others for approval. Generally the higher ups will assign this approval process to their secretaries. However, in the chance that 100 emails come in saying the same things, this usually trips the spam filter and goes into a folder that is generally automatically deleted unless someone detects it as not spam first. This is why form letters and such are not really noticed until someone sends a PR release stating over so many have been sent. then they look at their spam filter logs and realize 200k people are pissed at them.

    3. Re:My email to press@starbucks.com by CaptainDork · · Score: 2

      The Dilbert® effect.

      One time at band camp ...

      No, wait.

      One time at my review, the manager said, "The users love you, but your methods don't conform to corporate standards."

      --
      It little behooves the best of us to comment on the rest of us.
  5. Re:come on now! by PPH · · Score: 4, Funny

    It's pronounced "eye-gor."

    --
    Have gnu, will travel.
  6. Re:Funny by Deadstick · · Score: 2

    So docent this make starbucks liable

    And the award for Worst Spellchecker of 2015 goes to...

  7. Re:Israeli genocide? by nicoleb_x · · Score: 3, Funny

    I think Hitler tried something like that already.

  8. disclosure by Lehk228 · · Score: 5, Interesting

    more proof that responsible disclosure is foolish unless you are delaing with an organization you already have a solid IT/security relationship with.

    in any other situation, just post the exploit kit anonymously and make a bowl of popcorn

    --
    Snowden and Manning are heroes.
  9. #RaceConditionTogether by Phronesis · · Score: 4, Funny

    Starbucks can have a new slogan.

  10. Re:Ziobucks by tompaulco · · Score: 2

    Starbucks is a nasty company. Its CEO Howard Schultz is a fanatical Zionist; if you patronize Starbucks, you're supporting Israeli genocide.

    Being a publicly traded company, the financial information is available, so go ahead and show on their financials where they are sending money to support Israeli genocide.

    --
    If you are not allowed to question your government then the government has answered your question.
  11. Security wall of shame by Kardos · · Score: 4, Interesting

    Looks like we need a security wall of shame that lists the response to flaw disclosures of each organisation, so people can quickly determine which companies will fix a flaw upon receiving a report, and which companies are hostile and should not be contacted.

    1. Re:Security wall of shame by Em+Adespoton · · Score: 2

      I think people on here are having a difficult time differentiating between two actions that have taken place here: 1) security research that discovered a hole and 2) unauthorized abuse of that hole to prove a point and demonstrate the severity of the flaw.

      Starbucks is hostile to the second, not the first. If he'd stopped at discovering the flaw and bringing it to their attention, I doubt they'd be hostile.

      If you parked your car and someone noticed the door was unlocked and the keys were in the ignition and came and told you, that'd be under 1) -- if instead, they got in, drove your car up to the door of your building and honked the horn to get your attention, that's under 2). And that's exactly what he did.

      Looks like we also need a security researcher wall of shame that lists "researchers" who go beyond the research and commit federal crimes to demonstrate what the flaw allows them to do.

      Any time you're inside a network you're not supposed to have access to, you've crossed the "hacker" line from "white" to "grey". If you don't immediately back out and report, you've slid all the way to "black".

  12. I Detect Spin. by jklovanc · · Score: 2

    As there is no transcript of the phone call we have no idea what was actually said. It could have been something along the lines of "We try to guard against fraud and malicious behavior" or "continuing to do this could be considered fraud or malicious behavior". There is no proof the reporter was ever accused of either of those. Being accused makes a better story though.

  13. Gift cards suck by lucm · · Score: 2

    Why would anyone use those? There's no discount. A $25 gift card just entitles you to spend $25 worth of whatever that company has to sell. What's the point? To show someone that you know that they like coffee, so instead of giving them $25 you give them a $25 Starbucks gift card? It's not really more thoughtful than giving cash yet it's far less convenient for everyone involved. And why would you even refill those for yourself? Because you don't trust yourself with your own money?

    And a Starbucks gift card is not like those gas credit cards, the last resort of degenerate gamblers, junkies and broke-ass idiots who offer you to fill up your car using their card in exchange for $20 cash. At least those are convenient if you happen to stop for gas at the right place and the right time.

    Fuck gift cards.

    --
    lucm, indeed.
  14. Pride and Arrogance SUCK! by hamsterz1 · · Score: 2

    When a BIG CO is confronted with a security flaw, by someone outside the CO, they react in anger first, then fear, then they turn one the person/persons who confronted them. When you distill all the emotional cruft, it's that their pride was hurt. Never mind someone did "their" homework for them. They want to"save face".It makes them angry that YOU did something they should have done. No sharing of information for the common good, with arrogant pricks.:)